TFG London Cyberattack Disrupts IT Systems Used by Phase Eight, Hobbs, and Whistles Brands

TFG London has confirmed a cyberattack that disrupted IT systems supporting Phase Eight, Hobbs, and Whistles. South Africa’s The Foschini Group detected the incident on October 11, 2026, and disclosed it to shareholders on October 13. Several systems remained unavailable, although stores continued trading.

According to the company’s shareholder announcement, Inside Story and White Stuff were not affected. TFG Africa and TFG Australia also remained unaffected because they operate on separate systems. The confirmed disruption is therefore limited to part of the group’s UK business, rather than its global operations.

TFG London Cyberattack

TFG activated its incident response and business continuity plans after discovering the attack. External cybersecurity specialists are helping contain the incident, and the company has informed relevant UK authorities.

Its investigation is still examining whether personal or other sensitive information was compromised. Customers face disruption, even as stores remain open. Some website functions may be unavailable, and orders placed on or after October 11 could be delayed. Customers have been told not to resubmit those orders.

Purchases placed before Sunday are expected to be processed and delivered normally. In customer communications, TFG London said a third-party provider handles payment processing. Based on its investigation so far, it has “no reason to believe that payment information is at risk.”

However, the company has not ruled out exposure of other customer information and will directly notify people whose data was affected.

TFG has not disclosed the attackers’ identity, their entry point, or whether ransomware was involved. It has also not provided a deadline for full system recovery. These gaps matter because system unavailability alone does not show whether attackers encrypted files, stole data, or caused another form of disruption.

The separate systems used in Africa and Australia provide an important boundary to the reported impact. However, TFG has not published enough technical detail to establish which UK applications were affected or how access across the three brands was disrupted.

TFG’s June financial results described an earlier cyber incident affecting a key online concession partner. That disruption was one of several pressures on its UK portfolio.

Adjusted operating profit fell 65.4%, excluding brand impairment and acquisition costs. This figure should not be presented as the cost of October’s attack.

The wider retail context includes the Marks & Spencer cyberattack, which disrupted payment and collection services, and the Harrods supplier data breach, which exposed customer records.

Neither report links to TFG. For now, the central questions remain how they gained access, whether they stole information, and when affected services can safely return.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.

The post TFG London Cyberattack Disrupts IT Systems Used by Phase Eight, Hobbs, and Whistles Brands appeared first on Cyber Security News.